Okta

Use Okta as your Identity Provider.

Create OAuth Client

Note: The instructions in this section are only needed when Okta is used for authentication of the Atolio web application.

  1. Navigate to Applications in the Okta admin console (https://example.okta.com/admin/apps/active).
  2. Click “Create App Integration”.
  3. Select “OIDC - OpenID Connect” from the list of Sign-in methods.
  4. Select “Web Application” from the list of Application types and hit “Next” to create the app.
  5. (Optional) Edit the name and provide the Atolio logo for the app.
  6. Under “Grant type” –> “Client acting on behalf of a user”, ensure that “Authorization Code” is enabled.
  7. Under “Sign-in redirect URIs”, add the URL https://search.example.com/auth/_callback (note this is identical for Google).
  8. Under “Sign-out redirect URIs”, remove the default http://localhost:8080 URI.
  9. Under “Assignments”, choose who should have access to the Atolio app. This setting can be modified later. If you choose to “Skip group assignment for now”, remember to add yourself to the Assignments list in order to be able to sign-in.
  10. Click “Save”.
  11. Under “Client Credentials”, copy the “Client ID” & “Client Secret”. You’ll provide these to Atolio Support as described in What to Provide to Atolio Support.

What to Provide to Atolio Support

After completing the steps above, send the following values to Atolio Support (your Deployment Engineer).

ValueWhere to find itExample / formatSecret
Okta org URLThe address of your Okta admin console, without the -admin suffixhttps://example.okta.comNo
Client IDStep 11, “Client Credentials” section of the app0oa1b2c3d4e5f6g7h8i9No
Client SecretStep 11, “Client Credentials” section of the appLong random stringYes

Keep secrets secure: Share values marked “Yes” in the Secret column only through a password-manager share (e.g. 1Password) or another secure channel agreed with Atolio Support. Never send them in plain email, chat, or support tickets.

Setup Okta Connector

Once your Atolio infrastructure has been deployed, you will also need to setup the Okta Connector to enable users and user mappings using an API token.